Method for monitoring at least two redundant sensors

ABSTRACT

The invention relates to a method for monitoring at least two redundant sensors, which are in particular arranged in a chemical plant or an aircraft, comprising providing a first sensor signal of a first sensor, the first sensor signal comprising at least one measured value, providing at least one further sensor signal from a further sensor, the further sensor signal comprising at least one further measured value, generating a first analysis signal from the first sensor signal, generating at least one further analysis signal from the further sensor signal, determining at least one relationship between the first sensor signal and the further sensor signal at least in dependence on the first analysis signal and the further analysis signal over a time horizon, comparing the relationship with at least one admissible range, and, depending on the result of the comparison, determining whether at least one sensor of the two redundant sensors is faulty.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a Divisional of U.S. application Ser. No.16/062,033, filed 13 Jun. 2018, which is a National Stage entry ofInternational Application No. PCT/EP2016/081406, filed 16 Dec. 2016,which claims priority to European Patent Application No. 15200994.0,filed 18 Dec. 2015. Each of these applications is incorporated byreference in its entirety” to end of cross-ref paragraph.

BACKGROUND Field

The invention relates to a method for monitoring at least two redundantsensors, which are in particular arranged in a chemical plant. Theinvention also comprises a monitoring device for monitoring at least tworedundant sensors, e.g. in a chemical plant or in an aircraft.

Description of Related Art

There are many chemical plants in the chemical industry that have tomeet strict safety requirements because of the substances that areprocessed in these plants. One chemical plant by way of example, but notthe only one, is a toluene-2,4-diisocyanate (TDI) plant. For monitoringsuch a chemical plant, in particular as part of a protective safetyfunction, or as part of an automatic check of important flyingparameters of an aircraft by an autopilot, monitoring devices andsensors are used, in particular for the measuring of process variables,in order always to obtain current data on the at least one (chemical)process carried out in a plant. The current process data or processvariables recorded by the sensors are usually transmitted to amonitoring device and evaluated by the latter. In an evaluation theremay be specified, for example, an admissible range of values for the atleast one recorded process variable. If the monitoring device finds thatthe value recorded by the sensor lies outside the admissible range ofvalues, the process may be interrupted and/or an alarm output. Anautomatic control may also be carried out, in order to return thephysical variable recorded by the sensor to a setpoint value. It can inthis way be ensured for example that the emission from the chemicalplant of a substance that is harmful to the environment is detected atthe time and a further emission, and therefore harm, can be prevented.

A further application for redundant sensors that can be given by way ofexample is in aircraft. For example, the parameters that are importantfor a stable flying position are checked in an aircraft.

Sensors are used for carrying out the checks, in order for example torecord the flying speed. The flying parameters recorded are transmittedto the autopilot, which in the event of disturbances occurring takescontrolling countermeasures in order to keep the flying position stable.

One problem with such monitoring is, however, that the checking itselfmay be faulty because of a faulty sensor. In other words, correctmonitoring can only be ensured if the sensors used function faultlesslyand deliver correct actual values, that is to say correct physicalprocess variables. At this point, difficulties are encountered inparticular in detecting a faulty sensor. A faulty sensor is generallyonly detected if the sensor signal delivered by the sensor or themeasured values from this sensor signal lie(s) outside theaforementioned specified admissible range and the entire chemical plantis checked after being shut down and/or the aircraft is checked afterlanding. This however involves considerable loss of time, costs andeffort. Even greater harm can occur, however, if the faulty sensordelivers an erroneous sensor signal that lies within the admissiblerange even though an actual process value lies in the inadmissiblerange. In other words, a malfunction, for example the escape of aharmful substance from a plant, remains undetected because of the faultysensor.

In the case of the monitoring of an aircraft, a sensor may for exampleprovide an erroneous measured speed value to the autopilot because oficing. It is then possible that the aircraft may crash. In the eventthat a faulty sensor is not detected, this may for example mean that anerroneous speed measurement suggests to the autopilot a sufficientlygreat flying speed even though in truth the aircraft is too slow and isabout to stall, and consequently about to crash.

SUMMARY

The present invention is therefore based on the object of providing amethod for monitoring sensors that makes reliable detection of a faultysensor possible.

The object deduced and presented above is achieved according to a firstaspect of the invention by a method according to Patent Claim 1. Themethod is based on the use of at least two redundant sensors and thecomputer-implemented comparison of the measuring signals recorded bythese sensors. The subject matter of the application is correspondinglya method for monitoring at least two redundant sensors that are inparticular arranged in a chemical plant or in an aircraft, comprisingthe following steps:

-   -   a) providing a first sensor signal of a first sensor of the two        redundant sensors, the first sensor signal comprising at least        one measured value,    -   b) providing at least one further sensor signal from a further        sensor of the two redundant sensors, the further sensor signal        comprising at least one measured value,    -   c) generating at least one first analysis signal from the first        sensor signal,    -   d) generating at least one further analysis signal from the        further sensor signal,    -   e) selecting a horizon for the sensor signals from a), b) by        comparison of the analysis signals from c) and d) with a        predefined limit for the variance, stationarity and dynamics of        the sensor signal,    -   f) determining at least one correlation between the first        analysis signal of the first sensor and the analysis signal of        the further sensor or a difference between the first sensor        signal of the first sensor and the sensor signal of the further        sensor,    -   g) comparing the correlation with at least one admissible        correlation range or the difference with an admissible        difference range, and    -   h) depending on the result of the comparison according to g),        determining whether at least one sensor of the two redundant        sensors is faulty.

DETAILED DESCRIPTION OF A PREFERRED EMBODIMENT

The method according to the invention is typically carried out by acomputer that is designed for carrying out the steps.

Because, by contrast with the prior art, the sensor signals of tworedundant sensors are evaluated and at least in dependence on the twocorresponding analysis signals at least one correlation or a differencebetween the sensor signals is derived, a faulty sensor can be reliablydetected or attention can be drawn to incorrect behaviour of a sensor.The safety of the process being monitored can be increased. A faultysensor can be replaced without great effort, and as a result with lowcosts. The sensor signals from three or more sensors can in turn berespectively evaluated in pairs.

Redundant sensors should be understood according to the invention asmeaning that a first sensor is assigned at least one further (adjacent)sensor, which records in a measuring sense at least one similar,preferably the same, process variable. A first process variable isconsidered in the present case to be similar to a further processvariable if, on account of the sequence of the process, the two processvariables have a similar behaviour to one another, for example a similardynamic change over time, or the first process variable can be convertedinto the further process variable (and vice versa) by a calculation.

In one embodiment, at least one sensor may be designed to record as aprocess variable a pressure, a mass flow, a temperature, a quality, suchas a pH, a viscosity, a flow rate, a flying altitude etc. Alternatively,however, it may also be a variable calculated from measured values.Preferably, the redundant sensors can measure the same process variable.It goes without saying that three or more redundant sensors may also beprovided and be monitored, the comparison of the sensor signals, i.e.the ascertainment of the correlation or difference, according to step f)of the method then taking place in pairs.

From each of the at least two redundant sensors, at least one sensorsignal is respectively provided. In particular, it may be provided thatthe first sensor delivers a first sensor signal to a monitoring devicevia a suitable communication link and the further sensor delivers afurther sensor signal to the monitoring device via a suitablecommunication link A sensor signal comprises for the purposes of theapplication a multiplicity of measured values, which are preferablyrecorded by the sensor (almost) continuously over a time interval (alsoreferred to as an interval).

For the purposes of the application, a horizon for the testing of thesensors is defined by way of a time from the current point in time intothe past or by way of a number of available measurements to the currentmeasurement. Usually, a horizon is defined by way of a time (also knownas a time horizon). For the purposes of the application, a horizon maybe a moving horizon or a time interval.

It has been realized that, for a reliable evaluation or fault detection,first an analysis signal should be respectively determined, inparticular calculated, from the at least two sensor signals provided.For the purposes of the application, an analysis signal is a signal thatreproduces a measure of the variance, the stationarity or the dynamicsof the data or measured values last recorded by the sensor.

It has been realized that, for a reliable determination of a faultysensor, an analysis signal should have a sufficient number of measuredvalues, while always comprising the most current measured values. Thiscan be achieved by an analysis signal being produced over a movinghorizon. So if there is a new measured value, allowance is made for thisin the analysis signal and the oldest measured value is removed from theanalysis signal.

It has additionally been realized that the definition or selection ofthe horizon is decisive for the quality of the testing. According to theinvention, therefore, in step e) a selection of a horizon for the sensorsignals from a), b) takes place by comparison of the analysis signalfrom c) and d) with a predefined limit for the variance, thestationarity and the dynamics of the sensor signal.

In order to determine at least one faulty sensor, a correlation betweenthe at least two analysis signals or a difference between sensor signalsfrom two redundant sensors are determined or ascertained over thehorizon. It is also possible to establish a correlation directly(without calculation of analysis signals from the sensor signals)between the at least two sensor signals over the horizon, with thedisadvantage that, if the correlation is small, the reliability of themethod is lower. The at least one determined correlation or differenceis then compared with a (specifiable) admissible correlation range ordifference range. It goes without saying that, in particular in the caseof a plurality of different correlations or differences, correspondingdifferent admissible correlation ranges or difference ranges may bespecified. An admissible correlation range may also be implicitly givenby an explicitly stated admissible correlation range and/or at least onelimit value. This also applies to a difference range.

For the detection or determination of a faulty sensor, the determinedcorrelation or the difference is compared with an admissible correlationrange or difference range. In the event that the correlation or thedifference lies in the admissible range, there is no faulty sensor. Inthe event that the correlation of the difference does not lie in theadmissible range, there is a faulty sensor. Then, for example, an alarmmay be output. For example, measures for rectifying the fault, such asan exchange of the sensor, can then be initiated (includingautomatically). In order to avoid a false alarm, preferably the resultof the comparison is verified in at least one checking step. Forexample, it may be provided that first a warning is output, and only ifit is detected that the admissible correlation range or difference rangeis left a number of times (e.g. three times) is an alarm output.

It has been realized that various faults can occur. Faults, andconsequently faulty sensors, by way of example, but not the only ones,that can be detected by embodiments according to the invention areoffset faults, freezing faults and/or fouling faults. In the presentcase, an offset fault should be understood as meaning a constantinaccuracy of the measured values of one sensor in comparison with themeasured values of the other sensor of the at least two redundantsensors. The constant deviation in the measured values between theredundant sensors may be interpreted as a stationary inaccuracy of asensor. Freezing refers in the present case to the freezing of a sensorsignal. In other words, the sensor signal concerned may always indicatea constant (erroneous) value, while the other sensor may (correctly)indicate the dynamic variation of the measured process variable. Foulingis understood in the present case as meaning in particular a time delayin the dynamic behaviour of the measuring signal of one sensor inrelation to the measuring signal of the other sensor of the at least tworedundant sensors. This may be caused for example by soiling of asensor, such as an encrustation. The soiling may lead to a (dynamic)inertia of the sensor.

In a first embodiment of the method, a calculated standard deviation ofthe respective sensor signal in relation to a mean value over a movinghorizon is used as the analysis signal. A standard deviation is a (good)measure of the variance, the stationarity and the dynamics of themeasured data or of the measured values of the sensor signal.

In order in particular to detect an offset fault, in step e) of themethod, the standard deviation of each sensor signal is used as theanalysis signal. It is checked whether, for each sensor signal, themeasure of the dynamics of the current measuring datapoint (in otherwords the analysis signal) over a horizon is sufficiently small, that isto say whether the process is stationary. The stationarity of the sensorsignal is typically ascertained over a moving time horizon (alsoreferred to as a moving horizon). If the standard deviation of the firstsensor signal and the standard deviation of the further sensor signalrespectively have an admissible or sufficient stationarity for the sameperiod of time or points in time, that is to say for example do notexceed a corresponding limit value, the data or measured values aresufficiently stationary for an offset fault detection. Otherwise, thereis the risk because of short-term dynamics, e.g. in the chemical processor in the speed of an aircraft, that a report of a de facto non-existentoffset fault is given as a false alarm. A moving horizon of an analysissignal for offset checking is typically a few minutes. If the measuringdatapoints of the two sensors respectively have only little dynamicsover the moving horizon, after step f) of the method either thedifference of the measuring signals (a series of measuring datapoints)or just the difference of the current measuring datapoints of the twosensors is calculated—also referred to as the offset value—and comparedwith a maximum offset limit value. Depending on the result of thecomparison, it can be determined whether there is a faulty sensor. Ifthe comparison shows that the determined difference does not lie in anadmissible (specifiable) difference range or lies below a differencelimit value, it can be deduced from this result of the comparison thatthere is an offset fault. In other words, depending on the result of thecomparison, it can be determined in an easy and reliable way whether ornot there is a faulty sensor.

In further embodiments, the method according to the invention typicallycomprises a freezing and/or fouling check with the following steps:

In steps c) and d) of these checks, the standard deviations and thefirst and/or second derivative of each sensor signal over time isgenerated/calculated as analysis signals of the respective sensorsignal. In step e), a suitable horizon for the respective check isascertained, typically a checking interval (also referred to as aninterval) in which the recorded measuring datapoints of each sensorsignal have dynamic behaviour. Datapoints with dynamic behaviour referhere to datapoints that are locally (in relation to the neighbouringdatapoints) neither stationary nor characterized by a constant trend,i.e. a checking interval in which the gradient (first derivative) of therespective sensor signal over time varies sufficiently in the checkinginterval is ascertained. This is the case if the absolute value of thecalculated second derivative of the respective sensor signal issufficiently great (above a limit value). This is referred tohereinafter as dynamic behaviour. If, on the other hand, the sensorsignal exhibits non-dynamic behaviour, new measuring datapoints areadded to the checking interval under consideration, until it comprises aspecified minimum number of dynamic measuring datapoints.

For the freezing check, then, in step f), the analysis signals from c)and d) are used for the check and a difference signal (ΔA) is determinedfrom the first analysis signal (A1) and the further analysis signal(A2). Preferably, in step f) the standard deviations of the sensorsignals are respectively used as analysis signals. For the freezingcheck, however, it is also possible for the sensor signals to be useddirectly or their derivatives to be used as analysis signals. Then, afirst crosscorrelation Cov(A1, ΔA) between the determined differencesignal and the first analysis signal is determined. A furthercrosscorrelation Cov(A2, ΔA) between the determined difference signaland the further analysis signal is determined. Then, the ratio of thefirst crosscorrelation to the further crosscorrelation is determined. Instep g), this ratio is compared with an admissible correlation range, inparticular an admissible (specifiable) ratio range. If thecrosscorrelations differ by orders of magnitude, i.e. the calculatedratio is outside a specified ratio range, there is freezing and thefaulty sensor can be determined. If the absolute value of thecrosscorrelation Cov(A1, ΔA) is less than the other crosscorrelationCov(A2, ΔA), then sensor 1 is affected by freezing, and vice versa.

For a fouling check according to a particular embodiment of the methodaccording to the invention, the determination of at least onecorrelation (step f) of the method) comprises maximizing thecrosscorrelation between the first analysis signal and a furtheranalysis signal by way of different time displacements (ΔT). For this,typically the covariance Coy (A1, A2 (ΔT)) between the first analysissignal and the further analysis signal over the checking interval ismaximized by the time displacement A2(ΔT) of the further analysissignal. In other words, in step f) a delay time—also referred to asfouling time—is calculated as the correlation between the two sensorsignals. The fouling time is compared with an admissible delay timelimit value. If the fouling time lies above a maximum admissible limitvalue, there is a faulty sensor. Preferably, in step f), the standarddeviations of the sensor signals are respectively used as analysissignals. For the fouling check, it is also possible for the sensorsignals to be used directly or their derivatives to be used as analysissignals.

The at least two sensors to be monitored are redundant sensors. Thesemay for example be arranged in the direct vicinity of one another in adevice of a chemical plant. For example, they may be directly adjacentto one another and/or comprise a common housing or the like. Accordingto one embodiment, the redundant sensors may also be arranged at adistance from one another. For example, a first sensor may be located atthe beginning of a fluid line and a further sensor at the end of a fluidline. In the case of another example, an apparatus may be arrangedbetween the two sensors or the sensors may be arranged in differentapparatuses arranged one after the other. This structural relationshipbetween the first sensor and the second sensor may be determinedaccording to a further embodiment. For example, this determination maytake place (once) during the installation of the sensors. In apreprocessing step, at least one of the sensor signals provided may beprocessed on a time basis in a way dependent on the structuralrelationship of the sensors. In particular, in this way allowance can bemade for (known) plant-related delays between the first sensor signaland the further sensor signal. This makes it possible to detect a faultysensor of at least two redundant sensors even if the sensors are notdirectly adjacent but are arranged at a distance from one another.

According to a preferred embodiment, at least one of the sensor signalsprovided may be processed on a time basis in a way dependent on thestructural relationship of the sensors by a first-order time delayelement. In addition or as an alternative, at least one of the sensorsignals provided may be processed on a time basis in a way dependent onthe structural relationship of the sensors by a dead time element. Inparticular, it has been realized that process-engineering apparatusesthat are arranged between two redundant sensors can be described by afirst-order delay element (PT1) or a delay element of a higher order(PTn) or by a dead time element (PTt). If the dynamic behaviour of theprocess-engineering apparatus concerns a dead time element (PTt), thedownstream measuring signal can be delayed by way of a timedisplacement.

In order to improve the quality of the data on which the fault detectionis based, it may be provided according to a further embodiment that,before the determination of the first analysis signal and/or of thefurther analysis signal, at least one of the recorded sensor signals is(preprocessed) filtered in a filtering step, e.g. by a customary lowpassfilter, in such a way that measuring noise is filtered out from the(corresponding) sensor signal. This filtering step may be omitted if thenoise is normally distributed.

A further aspect of the invention is a monitoring device for monitoringat least two redundant sensors that are in particular arranged in achemical plant. The monitoring device comprises at least one receivingdevice designed for receiving a first sensor signal of a first sensor ofthe two redundant sensors and for receiving at least one further sensorsignal from a further sensor of the two redundant sensors. The firstsensor signal comprises at least one measured value and the furthersensor signal comprises at least one measured value. The monitoringdevice comprises at least one processing device designed for generatinga first analysis signal from the first sensor signal and for generatingat least one further analysis signal from the further sensor signal. Theprocessing device is designed for determining at least one correlationbetween the first analysis signal of the first sensor and the analysissignal of the further sensor or a difference between the first sensorsignal of the first sensor and the sensor signal of the further sensor.The monitoring device comprises at least one comparing device designedfor comparing the correlation or difference with at least one admissiblecorrelation or difference range or limit. The monitoring devicecomprises at least one evaluation device designed for determiningwhether, depending on the result of the comparison, at least one sensoris faulty.

The monitoring device is suitable in particular for carrying out themethod described above.

Yet another aspect of the invention is a chemical plant comprising atleast two redundant sensors and at least one monitoring device describedabove.

Yet another aspect of the invention is an aircraft comprising at leasttwo redundant sensors and at least one monitoring device describedabove.

The features of the methods, devices and plants can be freely combinedwith one another. In particular, features of the description and/or ofthe dependent claims may be independently inventive on their own or whenfreely combined with one another, even while completely or partiallycircumventing features of the independent claims.

There are thus a multitude of possibilities for refining and furtherdeveloping the monitoring device according to the invention, the methodaccording to the invention and the chemical plant according to theinvention. In this respect, reference should be made on the one hand tothe patent claims arranged subordinate to the independent claims, on theother hand to the description of exemplary embodiments in conjunctionwith the drawing. In the drawing:

FIG. 1 shows a schematic partial view of an exemplary embodiment of achemical plant according to the present invention;

FIG. 2 shows a schematic partial view of a further exemplary embodimentof a chemical plant according to the present invention;

FIG. 2a shows a schematic partial view of an exemplary embodiment of anaircraft according to the present invention;

FIG. 3 shows a schematic view of an exemplary embodiment of a monitoringdevice according to the present invention;

FIG. 4 shows a diagram of an exemplary embodiment of a method accordingto the present invention;

FIG. 5 shows a diagram given by way of example with variations of sensorsignals;

FIG. 6 shows a further diagram given by way of example with variationsof analysis signals; and

FIG. 7 shows a further diagram given by way of example with variationsof analysis signals.

Hereinafter, the same designations are used for the same elements.

FIG. 1 shows a schematic partial view of an exemplary embodiment of achemical plant 100 according to the present invention. In particular, inthe present exemplary embodiment part of a fluid line 106 of a chemicalplant 100 is depicted. Through the fluid line 106 there flows a fluid,which can be monitored by redundant sensors 102.1, 102.2.

In the present case, two redundant sensors 102.1, 102.2 are arranged inthe fluid line 106. In the present exemplary embodiment, the sensors102.1, 102.2 are at a distance from one another.

Allowance may be made for the structural relationship between thesensors 102.1, 102.2 in the detection of a faulty sensor 102.1, 102.2,as will be explained below. The sensors 102.1, 102.2 may however also bearranged directly next to one another. Furthermore, the redundantsensors 102.1, 102.2 may be designed for measuring at least one similarprocess variable. For example, the process variable may be thetemperature of the fluid, the pressure within the fluid line 106, theflow rate, the pH of the fluid, etc.

The first sensor signal may be made available by the first sensor 102.1to a monitoring device 104 via a communication link 108. A furthersensor signal may be made available by the further sensor 102.2 via acommunication link 108 of the monitoring device 104. Each sensor signalmay be formed by a plurality of measured values. The monitoring device104 is designed in particular to detect a faulty sensor 102.1, 102.2.When a faulty sensor 102.1, 102.2 is detected, corresponding informationcan be issued via an output 110 from the monitoring device 104.

The monitoring device 104 may be at least part of a computing devicecomprising processing means, storage means, etc.

FIG. 2 shows a schematic partial view of a further exemplary embodimentof a chemical plant 200 according to the present invention. Incomparison with the exemplary embodiment above, in this exemplaryembodiment a chemical apparatus 212 is provided, arranged between theredundant sensors 202.1 and 202.2. The chemical apparatus 212 may bedesigned for processing a substance or a fluid. Allowance may also bemade for the structural relationship between the redundant sensors 202.1and 202.2 in a detection of a faulty sensor 202.1, 202.2. The respectivesensor signals of the first and further sensors 202.1, 202.2 may bedelivered to a monitoring device 204.

FIG. 2a shows a schematic partial view of an exemplary embodiment of anaircraft 250 according to the present invention. The speed of theaircraft is monitored in the present case by the sensors 252.1, 252.2.The first sensor signal may be made available by the first sensor 252.1to a monitoring device 254 via a communication link 258. A furthersensor signal may be made available by the further sensor 252.2 to themonitoring device 254 via a communication link 258. Each sensor signalmay be formed by a plurality of measured values. The monitoring device254 is designed in particular to detect a faulty sensor 252.1, 252.2. Ifa faulty sensor 252.1, 252.2 is detected, corresponding information canbe issued via an output 260 from the monitoring device 254.

An exemplary embodiment of a monitoring device 104, 204, 254 isexplained in more detail below.

FIG. 3 shows a schematic view of an exemplary embodiment of a monitoringdevice 304 according to the invention. As can be seen, the monitoringdevice 304 has in the present case a first receiving device 314.1designed for receiving a first sensor signal and a further receivingdevice 314.2 designed for receiving a further sensor signal. It goeswithout saying that a common receiving device may also be provided.

In the present case, the two sensor signals are provided for aprocessing device 316. The processing device 316 is designed to generatea first analysis signal from the first sensor signal and to generate atleast one further analysis signal from the further sensor signal.Furthermore, the processing device 316 is designed for determining atleast one correlation between the first analysis signal of the firstsensor and the analysis signal of the further sensor or a differencebetween the first sensor signal of the first sensor and the sensorsignal of the further sensor.

The correlation or the difference may be made available to a comparingdevice 318, which is designed for the comparison with at least oneadmissible (specified) correlation or difference range or limit. Theresult of the comparison may be made available to an evaluation device320. The evaluation device 320 is designed for determining whether atleast one sensor is faulty. This determination takes place in a waydependent on the result of the comparison. If the evaluation device 320finds that at least one of the monitoring sensors is operating faultily,it can pass this on to an output device 322, in order for example togive a warning and/or an alarm by way of an output 310.

The monitoring device described above of the chemical plant or of theaircraft is described in more detail below with the aid of FIG. 4. FIG.4 shows a diagram of an exemplary embodiment of a method according tothe present invention. It should be noted for the following statementsthat the sensors are denoted by the index s and the measured value of asensor is denoted by m.

In a first step 401, a sensor signal is respectively made available bythe at least two redundant sensors. In particular, a monitoring devicereceives at least one first sensor signal of a first sensor and afurther sensor signal of a further sensor. The further sensor forms areference for the first sensor to be investigated.

Conversely, the first sensor is the reference for the further sensor.Consequently, it is always possible for at least two sensors to beinvestigated together as a pair of sensors. A detection of a fault maythen concern this pair of sensors. The fault should be interpreted inparticular as a relative fault. A detected fault may consequently beinterpreted either as a positive fault for one sensor or as a negativefault for the other sensor.

In an optional next step 402, allowance may be made for structuralrelationships between the redundant sensors, in particular plant-relateddelays between the first sensor signal and the further sensor signal. Aplant-related delay may for example result from the different measuringpositioning of the first sensor, e.g. at a first end of a fluid line,and a further sensor, e.g. at the other end of the fluid line (cf. FIG.1). A further example is that a first sensor is arranged upstream of achemical apparatus and a further sensor is arranged downstream of thechemical apparatus (cf. FIG. 2).

Preferably, in step 402, the structural relationship for the thenresultant dynamic behaviour may be (roughly) described by a first-orderdelay element (PT1) and/or by a dead time element (PTt). In the examplesmentioned above, the upstream sensor may be delayed by the first-orderdelay element (PT1) or a delay element of a higher order (PTn) or by thedead time element (PTt), in order in particular to achieve the effectthat the measurements of the two sensors are characterized by the sametemporally adapted process dynamics. This allows a more reliableanalysis of sensor behaviour.

With the aid of a volumetric flow measurement V between the twomeasuring positions, the time constant T_(delay) can be calculated as adelay time between the two measuring positions of the first and furthersensors.

$\begin{matrix}{{T_{delay} = \frac{V}{\overset{.}{V}}},} & (1)\end{matrix}$

where V is the volume, assumed to be known, of a fluid line or thefilling volume of the chemical apparatus or the like.

If the dynamic behaviour of the apparatus located between the measuringpositions concerns a first-order delay element (PT1), the upstreammeasuring signal can be delayed in time in particular by way of a PT1filter:

$\begin{matrix}{{{m\left( t_{k} \right)} = {{\frac{T_{delay}}{T_{samp} + T_{delay}}{m\left( t_{k - 1} \right)}} + {\frac{T_{delay}}{T_{samp} + T_{delay}}{m_{orig}\left( t_{k} \right)}}}},} & (2)\end{matrix}$

where m_(orig) denotes the original measured value and T_(samp) denotesthe sampling time between the measured values or datapoints that aremeasured and t_(k) denotes the current point in time.

Generally, the filtering of the measuring signal can be formulated asfollows:

m(t _(k))=filter(m(t _(k−1)),m _(orig) ,T _(delay) ,T _(samp)).  (3)

If the dynamic behaviour of the apparatus located between the measuringpositions concerns a dead time element (PTt), the downstream measuringsignal can preferably be delayed by way of a time displacement

m(t _(k))=m _(orig)(t _(k) −T _(delay)),  (4)

where m_(orig) is the original measured value.

It goes without saying that this step 402 may be omitted if there is noneed to make allowance for structural relationships between the sensors,such as plant-related delays, because of a substantially identicalmeasuring position.

In an optional step 403, sensor signals may be filtered to improvesignal quality. For example, it may be envisaged to preprocess the firstand/or the further sensor signal by way of a filter, such as afirst-order filter PT1, in order to filter out measurement noise and/orshort-term dynamic trends:

$\begin{matrix}{{{m_{f}\left( t_{k} \right)} = {{\frac{T_{fil}}{T_{samp} + T_{fil}}{m_{f}\left( t_{k - 1} \right)}} + {\frac{T_{fil}}{T_{samp} + T_{fil}}{m\left( t_{k} \right)}}}},} & (5)\end{matrix}$

where m(t_(k)) is the measurement of the respective sensor at the pointin time t_(k), m_(f)(t_(k)) is the filtered measurement, T_(fil) is thefiltering time, and T_(samp) is the sampling time of the measurement(e.g. in the process control system or in the separate analysiscomputer).

Generally, the filtering of the measuring signal can be formulated asfollows:

m _(f)(t _(k))=filter(m _(f)(t _(k−1)),m(t _(k)),T _(fil) ,T_(samp)).  (6)

Following the optional steps 402 and 403, in step 404 a first analysissignal, preferably a standard deviation, may be generated, in particularcalculated, from the first sensor signal and a further analysis signal,preferably a standard deviation, may be generated, in particularcalculated, from the further sensor signal. As already described, thesensor signals may have been preprocessed in steps 402 and 403. Forexample, in step 404, the standard deviation x(t_(k)) or std(t_(k)) ofthe filtered sensor signal may then be calculated over a moving horizon:

$\begin{matrix}{{{x\left( t_{k} \right)} = {{{std}\left( t_{k} \right)} = \sqrt{\frac{1}{n - 1}{\sum\limits_{i = 1}^{n}\left( {m_{f}\left( {t_{k - i + 1} - {{\overset{\_}{m}}_{f}\left( t_{k} \right)}} \right)}^{2} \right.}}}},} & (7)\end{matrix}$

where m _(f) (t_(K)) is an average value, which can be calculated asfollows:

$\begin{matrix}{{{\overset{\_}{m}}_{f}\left( t_{K} \right)} = {\frac{1}{n}{\sum\limits_{i = 1}^{n}{{m_{f}\left( t_{k - i + 1} \right)}.}}}} & (8)\end{matrix}$

The moving horizon makes allowance in particular for the datapoints ormeasured values of the last n datapoints as from the present point intime. As the name already implies, the moving horizon moves as timepasses, in particular in real time. If a new measured value isavailable, the last datapoint is dropped from the horizon; the remainingdatapoints are displaced back by one time increment and the currentdatapoint with the new measured value is added. Generally, thecalculation of the analysis signal ((7) and (8)) can be formulated asfollows:

x(t _(k))=std(t _(k))=std(filter(m _(f)(t _(k)), . . . ,m _(f)(t_(k−n+1))).  (9)

In step 404, it is possible in particular to generate analysis signalsthat are particularly suitable as a starting point for the detection ofan offset fault and/or a freezing fault. In particular, it has beenrealized that an analysis signal with fewer data values is required fora reliable detection of an offset fault and/or a freezing fault than inthe case of the detection of a fouling fault. For the subsequentlydescribed offset and freezing calculation, the analysis signal x(t_(k))can be evaluated over a relatively short horizon n. The monitoring ofthe sensors can therefore take place at the time of the occurrence ofpossible offset and freezing faults, while the monitoring of foulingfaults may require a greater horizon, and fouling faults therefore canonly be detected with a delay. For the offset calculation, it may inparticular be sufficient if the process is stabilized for a short time.Also the freezing calculation on the basis of analysis signals with arelatively short horizon functions sufficiently robustly. For a robustfouling calculation, the long-term dynamic trends are more important, sothat here a separate analysis signal x(t_(k)) may be determined over alonger horizon n in a step 422, as will be described below.

In order to detect an offset fault, allowance for at least oneplant-related process deviation may be made in an optional step 406. Inparticular, a correction value Δm_(correction) that makes allowance forthe at least one plant-related process deviation may be determined. Thecorrection value Δm_(correction) may be required in particular whenever,for plant-related reasons, the process values of the measurement m₂ atthe further sensor differ from the process values of the measurement m₁at the upstream first sensor. The correction value may be known and inparticular specified.

In a next optional step 408, it may be checked whether the analysis data(the analysis signals) are sufficiently steady for an offset check.Every chemical plant (continuously) undergoes dynamic changes, which maybe caused e.g. by disturbances or changes in setpoint values. In otherwords, a chemical plant is not continuously operated in a stationarystate. Even if the sensors are arranged adjacently, the sensors to beinvestigated are not located exactly at the same place in the chemicalplant. This leads to a time delay, for plant-related reasons, betweenthe physical variables that are recorded by the two sensors. Theseshort-term dynamic changes, for example because of disturbances orchanges in setpoint values, cannot be predicted in advance, andtherefore also cannot be filtered out in a way corresponding to step 402or in a similar way. Nevertheless, allowance should be made for them inthe offset detection in order to prevent false detections. In otherwords, the aim is not to interpret the occurrence of dynamic changesthat lead to physical values deviating from one another for a short timeat the positions of the redundant sensors as an offset between the twosensors. For a particularly reliable offset fault detection, it istherefore preferred to check in step 408 whether the first and furtheranalysis signals are sufficiently stationary, i.e. that the dynamicchanges in the plant are relatively small.

As already described, an analysis signal in the form of a standarddeviation is a measure of the variance of the data or a measure of thestationarity of the data, that is to say of the corresponding sensorsignal. In order to ensure that only sufficiently stationary analysissignals are used in the further determination of an offset fault, thefirst analysis signal x₁(t_(k)) and the further analysis signalx₂(t_(k)) may be compared with at least one (specified) limit valuestd_(lim). The following comparison may be carried out in step 408:

x ₁(t _(k))<std_(lim)

x ₂(t _(k))<std_(lim)  (10)

If the result of the comparison from (10) is positive, then it ispossible to continue with step 410. In particular, the difference (=meandeviation Δm) between the sensor signals can then be determined independence on the analysis signals. In the case of a negative result ofthe comparison from (10), the procedure may be interrupted, inparticular for as long as it takes for the check to produce asufficiently positive outcome.

In step 410, the mean deviation Δm, in particular the absolute value ofthe mean deviation Δm, of the measured values m of the sensor signalsmay be determined. In this case, allowance can be made for thecorrection value Δm_(correction) determined in step 406. Preferably, thefollowing calculation can be carried out by the processing device instep 412:

Δm=|m _(f,2)(t _(k))−m _(f,1)(t _(k))+Δm _(correction)|.  (11)

In step 412, the comparing device may compare the mean deviation Δm, inparticular the absolute value of the mean deviation Δm, determined instep 410 with an admissible deviation. Preferably, the deviation Δm maybe scaled in advance to the measuring range of the sensor. The followingcomparing operations can be carried out:

$\begin{matrix}{{\frac{\Delta m}{{meas}u{r.r}ange}} < {{off}_{\lim}.}} & (12)\end{matrix}$

In particular, it is checked according to (12) whether the meandeviation Δm lies within an admissible range, that is to say does notexceed a (specified) limit value off_(lim). Depending on the result ofthe comparison, it is determined in particular by the evaluating devicewhether there is a faulty sensor. If the limit value off_(lim) isexceeded, i.e. the deviation between the sensor signals therefore liesin an inadmissible range, one of the two redundant sensors has a fault,in particular an offset fault.

In the next step 414, in the case of such a result of the comparison, awarning and/or an alarm may be output. For example, it may be providedthat, to avoid a false alarm, first only a warning is output. If thiswarning is repeated over repeat_(offset) successive sampling increments(where the process should continue to be stationary over the respectivesampling increments (10)), an alarm concerning the incorrect behaviourof the pair of sensors may take place.

FIG. 5 shows a diagram with a variation of a first sensor signal 532 andof a further sensor signal 534 given by way of example. The designation536 identifies the point in time from which an offset fault occurs. Itgoes without saying that the variations shown are schematic variations.

As already described, it may in addition or as an alternative beprovided that a freezing fault of a sensor is detected by the method inthat, depending on the analysis signals generated in step 404, acorrelation is determined as set out below. In particular, the freezingcalculation may be performed by way of an evaluation of thecrosscorrelations of the two analysis signals.

In step 416, a difference signal Δx may be determined from the firstanalysis signal x₁(t_(k)) and the further analysis signal x₂(t_(k)):

Δx=x ₂(t _(k))−x ₁(t _(k)).  (13)

As already described, freezing should be understood in the present caseas meaning that the sensor signal from a sensor has frozen at a constantvalue, and consequently its standard deviation, that is to say theanalysis signal, becomes zero.

Then, in step 416, crosscorrelations between the difference signal Δxand the analysis signal x₁(t_(k)) from the first sensor and thedifference signal Δx and the analysis signal x₂(t_(k)) from the furthersensor may be analysed. For the analysis, the respective analysis signal(9) may for example be collected over an interval p with the lengthn_(freeze) (e.g. 1000 measured values). When the interval p is filledwith datapoints of the analysis signal, the crosscorrelations betweenthe difference signal Δx and the analysis signal x₁(t_(k)) arecalculated. This corresponds to the covariance cov_(x1,Δx,p) between theanalysis signal x_(1,p) and the difference signal Δx_(p):

cov_(x1,Δx,p)=cov(x _(1,p) ,Δx _(p)).  (14)

The crosscorrelations between the difference signal Δx and the analysissignal x₂(t_(k)) can be calculated in a corresponding way. Thiscorresponds to the covariance cov_(x2,Δx,p) between the analysis signalx_(2,p) and the difference signal Δx_(p):

cov_(x2,Δx,p)=cov(x _(2,p) ,Δx _(p)).  (15)

A detailed possible way of determining the covariance is describedbelow. The covariance between the difference signal Δx and the analysissignal x₁(t_(k)) can be calculated as follows:

$\begin{matrix}{{cov_{{x\; 1},{\Delta\; x},p}} = {\frac{1}{n_{{freez}e} - 1}{\sum\limits_{i = 1}^{n_{freeze}}{\left( {{x_{1}\left( t_{k - i + 1} \right)} - {\overset{\_}{x}}_{1,p}} \right)*{\left( {{\Delta{x\left( t_{k - i + 1} \right)}} - {\overset{\_}{x}}_{p}} \right).}}}}} & (16)\end{matrix}$

The crosscorrelations between the difference signal Δx and the analysissignal x₂(t_(k)) can be calculated correspondingly:

$\begin{matrix}{{cov_{{x\; 2},{\Delta\; x},p}} = {\frac{1}{n_{{freez}e} - 1}{\sum\limits_{i = 1}^{n_{freeze}}{\left( {{x_{2}\left( t_{k - i + 1} \right)} - {\overset{\_}{x}}_{2,p}} \right)*{\left( {{\Delta{x\left( t_{k - i + 1} \right)}} - {\overset{\_}{x}}_{p}} \right).}}}}} & (17)\end{matrix}$

For the calculations, the average value x _(1,p) of the first analysissignal x₁(t_(k))

$\begin{matrix}{{\overset{\_}{x}}_{1,p} = {\frac{1}{n_{freeze}}{\sum\limits_{i = 1}^{n_{freeze}}{x_{1}\left( t_{k - i + 1} \right)}}}} & (18)\end{matrix}$

the average value x _(2,p) of the further analysis signal x₂(t_(k))

$\begin{matrix}{{\overset{\_}{x}}_{2,p} = {\frac{1}{n_{freeze}}{\sum\limits_{i = 1}^{n_{freeze}}{x_{2}\left( t_{k - i + 1} \right)}}}} & (19)\end{matrix}$

and the average value x _(p) of the difference signal Δx

$\begin{matrix}{{\overset{\_}{x}}_{p} = {\frac{1}{n_{freeze}}{\sum\limits_{i = 1}^{n_{freeze}}{\Delta\;{x\left( t_{k - i + 1} \right)}}}}} & (20)\end{matrix}$

are calculated. This calculation may be carried out as soon as thecurrent interval is filled with n_(freeze) data or measured values. Whenthe interval and the freezing calculation have been completed, thecurrent data (of the current point in time) can be collected for thenext interval until there are again n_(freeze) data.

Subsequently, in step 416, the ratio of the two crosscorrelationscov_(x1,Δx,p) and cov_(x2,Δx,p) is determined as a correlation. Theratio may be compared in a comparing step 418 with an admissible(specified) ratio range. For example, a limit value ratio_(freezing,tol)(e.g. ratio_(freezing,tol)=1000) may be specified. If the ratio lieswithin the admissible ratio range, there is no fault. Otherwise, it canbe deduced that there is a faulty sensor. If there is a fault, it ispossible in particular for the defective sensor to be identified asfollows. If

$\begin{matrix}{{\frac{{co}v_{{x\; 1},{\Delta\; x},p}}{{co}v_{{x\; 2},{\Delta\; x},p}}} > {ratio}_{{freezing},{tol}}} & (21)\end{matrix}$

then the ratio lies in a further inadmissible sub-range. The furthersensor is defective (frozen). If

$\begin{matrix}{{\frac{{co}v_{{x\; 2},{\Delta\; x},p}}{{co}v_{{x\; 1},{\Delta\; x},p}}} > {ratio}_{{freezing},{tol}}} & (22)\end{matrix}$

then the ratio lies in a first inadmissible sub-range. The first sensoris defective (frozen).

In these cases, a warning and/or an alarm may be output in step 420. Forexample, it may be provided that, to avoid a false alarm, first only awarning is output. In particular, if (21) or (22) is satisfied, awarning for the respective sensor may be output. If this warning isrepeated over (specifiable) repeat_(freezing) successive intervals, analarm concerning the incorrect behaviour of the identified sensor maytake place.

FIG. 6 shows a diagram of a first analysis signal 638 given by way ofexample, a further analysis signal 640 given by way of example and adifference signal 642 resulting from these signals 638, 640. Thedesignation 644 represents the point in time from which the furthersensor is frozen; the resultant analysis signal therefore gives 0. Ascan be seen, the analysis signal of the further signal correlates withthe difference signal of the analysis signals. From this it can bededuced that the first sensor is frozen. It goes without saying that thevariations shown are schematic variations.

As already described, it may in addition or as an alternative beprovided that a fouling fault of a sensor is detected by the method. Thedetection of a fouling fault may likewise be performed by way of anevaluation of the crosscorrelations of the two analysis signals. It maybe based on a maximization of the covariance between the analysissignals. The analysis signals described above of the two redundantsensors may be stored over an interval q with a length(n_(fouling)+2*z_(max)). In particular, the interval q has been extendedby the data 2*z_(max). In the present case, 2*z_(max) represents thesearch domain of the fouling calculation presented below. In the presentcase, n_(fouling) represents the length of the actual core of theinterval q. The fouling analysis may be carried out as soon as theinterval q is filled with data. It is important for the foulingcalculation that there is a meaningful set of data in the interval q,characterized by sufficient dynamics in the data. Therefore, the core ofthe interval n_(fouling) must be chosen to be sufficiently long, so thattime intervals in which the process is running in a stationary state canbe bridged. The length n_(fouling) of the core of the interval may bechosen to be constant. Alternatively, the length n_(fouling) may also bekept variable. The length may be calculated here by way of an optionalcalculation that can be carried out in step 424 in such a way that thedata are excited by sufficient dynamics in order to make an even morereliable fouling fault detection possible.

In particular, after generating a first analysis signal and a furtheranalysis signal, in step 422 the following determination may be carriedout:

The aim of the determination is in particular that in both the analysissignals there are respectively datapoints with sufficient dynamics inthe interval. A dynamic measuring datapoint is characterized here bydynamic behaviour in comparison with its neighbouring measuringdatapoints, i.e. that the first derivative with respect to time at thedatapoint considered is not constant, the process value or measuredvalue therefore does not rise (or fall) with a constant slope or isstationary. The second derivative is a measure that the first derivativewith respect to time at the datapoint considered is constant.

The determination in step 424 for calculating the interval lengthinvestigates in particular the second derivative of a datapoint ormeasured value with respect to time. This involves using the signal ofthe filtered measured value m_(f,k)(6).

For the datapoint m_(f,k) at the point in time t_(k), it is possible tocalculate the second derivative Δ²m_(f,k) with the sampling timeT_(samp) with the aid of the neighbouring datapoints m_(f,k−1) at thepoint in time t_(k−1), and m_(f,k−2) at the point in time _(tk−2):

$\begin{matrix}{{{\Delta^{2}m_{f,k}} = \frac{m_{f,k} - {2m_{f,{k - 1}}} + m_{f,{k - 2}}}{T_{samp}^{2}}}.} & (23)\end{matrix}$

Datapoints that satisfy the condition for non-dynamic behaviour, e.g.:

|Δ² m _(f,k)|<ε_(dyn)  (24)

can be collected in the dataset n_(fouling,non-dyn)·ε_(dyn) is a smallpositive (specifiable) tolerance, which in the present case serves as ameasure of dynamic behaviour.

n _(fouling,non-dyn)|(|Δ² m _(f,k)|<ε_(dyn))  (25)

The n_(fouling,non-dyn) datapoints in the interval q are notparticularly suitable for fouling detection. The data that aresufficiently dynamic, that is to say do not satisfy condition (24), arecollected in the dataset n_(fouling,dyn):

n _(fouling,dyn)|(|Δ² m _(f,k)|≥ε_(dyn)).  (26)

If non-dynamic datapoints are detected in an interval q, the lengthn_(fouling) of the core of the interval q may be increased in such a waythat the (specified) dynamic condition that at least n_(fouling,dyn,min)dynamic datapoints are contained in the interval q for at least onesensor is satisfied. Preferably, the dynamic condition is demanded forboth sensors, as set out in formula (27).

n _(fouling)>max(n _(fouling,non-dyn,s) +n _(fouling,dyn,min)).  (27)

The index s stands here for the first sensor or the further sensor. Inother words, there must preferably be sufficient dynamic datapoints ormeasured values for both sensors in the interval q.

In step 426, the crosscorrelation between the two sensors can then bemaximized by the processing device, in that the first analysis signalfrom the first sensor is displaced in comparison with the furtheranalysis signal of the further sensor in such a way that the twoanalysis signals are made to coincide.

In particular, the maximization of the crosscorrelation can be achievedby the covariance between the first analysis signal and the furtheranalysis signal over the interval q being maximized on the basis of thedisplacement of the further analysis signal. The displacement of thefurther analysis signal may be performed by way of z time increments inthe negative or positive direction. The covariance cov_(q) in theinterval q can be maximized as a degree of freedom with the aid of z,where z is the number of time increments by which the further analysissignal is displaced. The displacement z may be restricted by [−z_(max),z_(max)]. In the interval q, the covariance cov_(q) is calculated withthe aid of the analysis signals:

$\begin{matrix}{\mspace{79mu}{{\max\limits_{z}{cov}_{q}}{{s.t.\mspace{14mu}{cov}_{q}} = {{cov}\left( {{x_{1}\left( t_{k - z_{\max}} \right)},\ldots\mspace{14mu},{x_{1}\left( t_{k - n_{f{ouling}} + 1 - z_{\max}} \right)},\ldots\mspace{14mu},{x_{2}\left( t_{k - z_{\max} + z} \right)},{\ldots\mspace{14mu}{x_{2}\left( t_{k - n_{f{ouling}} + 1 - z_{\max} + z} \right)}}} \right)}}\mspace{79mu}{z \in {\left\lbrack {{- z_{\max}},z_{\max}} \right\rbrack.}}}} & (28)\end{matrix}$

In particular, the maximization for the first analysis signal x₁ and thefurther analysis signal may take place as follows:

$\begin{matrix}{\mspace{79mu}{{\max\limits_{z}{cov}_{q}}{{s.t.\mspace{14mu}{cov}_{q}} = {\frac{1}{n_{fouling} - 1}{\sum\limits_{i = 1}^{n_{fouling}}{\left( {{x_{1}\left( t_{k - i + 1 - z_{\max}} \right)} - {\overset{\_}{x}}_{1,q}} \right)*\left( {{x_{2}\left( t_{k - i + 1 - z_{\max} + z} \right)} - {\overset{\_}{x}}_{2,q}} \right)}}}}\mspace{79mu}{{z \in \left\lbrack {{- z_{\max}},z_{\max}} \right\rbrack},}}} & (29) \\{\mspace{79mu}{where}} & \; \\{\mspace{79mu}{{\overset{\_}{x}}_{1,q} = {\frac{1}{n_{fouling}}{\sum\limits_{i = 1}^{n_{fouling}}{x_{1}\left( t_{k - i + 1 - z_{\max}} \right)}}}}} & (30) \\{\mspace{79mu}{and}} & \; \\{\mspace{79mu}{{\overset{\_}{x}}_{2,q} = {\frac{1}{n_{fouling}}{\sum\limits_{i = 1}^{n_{fouling}}{{x_{2}\left( t_{k - i + 1 - z_{\max} + z} \right)}.}}}}} & (31)\end{matrix}$

The fouling time τ may be determined as a correlation condition from theperformed displacement z, that is to say the number z of datapoints bywhich the further analysis signal x₂ has been displaced, and thesampling time T_(sample). For example, the fouling time τ may becalculated as follows:

τ=T _(sample) *z.  (32)

In a comparing step 428, this correlation condition may be compared withan admissible fouling time range.

|τ|>τ_(warn)  (33)

Depending on the result of the comparison, it is determined whetherthere is a faulty sensor. If the limit value τ_(warn) is exceeded, thecorrelation condition therefore lies in an inadmissible range, one ofthe two redundant sensors has a fault, in particular a fouling fault.

In the next step 430, a warning and/or an alarm may be output. Forexample, it may be provided that, to avoid a false alarm, first only awarning is output. If this warning is repeated over (specifiable)repeat_(fouling) successive intervals, an alarm concerning the incorrectbehaviour of the pair of sensors may take place.

FIG. 7 shows a diagram given by way of example with a first analysissignal 746, a further analysis signal 750 and the analysis signal 748displaced by 752. Here, 752 is the time constant resulting from thecalculation, which is referred to as the fouling time. It goes withoutsaying that the variations shown are schematic variations. Thedesignation 754 denotes the search domain.

1. A computer-implemented method for monitoring at least two redundant sensors arranged in a chemical plant or an aircraft, comprising: a) providing at least two redundant sensors, b) providing a first sensor signal of a first sensor of the at least two redundant sensors, the first sensor signal comprising at least one measured value, c) providing at least one further sensor signal from a further sensor of the at least two redundant sensors, the further sensor signal comprising at least one further measured value, d) generating at least one first analysis signal from the first sensor signal, e) generating at least one further analysis signal from the further sensor signal, f) selecting a time horizon for the sensor signals from b), c) by comparison of the analysis signals from d) and e) with predefined limits for the variance, stationarity and/or dynamics of the sensor signal, g) determining at least one correlation between the first analysis signal of the first sensor and the analysis signal of the further sensor, h) comparing the correlation with at least one admissible correlation range or the difference with an admissible difference range, and i) depending on the result of the comparison according to h), determining whether at least one sensor of the two redundant sensors is faulty, j) issuing the determination according to i); wherein in d), a standard deviation of the first sensor signal is generated, and in e), a standard deviation of the further sensor signal is generated, and in f), the horizon is a moving horizon, wherein the standard deviation of the first sensor signal and the standard deviation of the further sensor signal respectively do not exceed a specified stationarity limit for the same period of time or for the same points in time, in g), the average deviation between the at least one measured value of the first sensor signal and the at least one measured value of the further sensor signal is determined, and, in h), the average deviation is compared with an admissible average deviation.
 2. The method according to claim 1, wherein a spatial distance between the first sensor and the further sensor is determined, and depending on a volumetric flow measurement and on the spatial distance between the sensors, at least one of the sensor signals provided is processed on a time basis.
 3. The method according to claim 2, wherein depending on the spatial distance between the first sensor and the further sensor, one of the sensor signals provided is processed on a time basis by a delay element of at least the first order, and/or depending on the volumetric flow measurement and on the spatial distance between the sensor and the further sensor, one of the sensor signals provided is processed on a time basis by a dead time element.
 4. Method according to claim 1, wherein, before determination of the first analysis signal and/or of the further analysis signal, at least one of the recorded sensor signals is filtered in a filtering step in such a way that at least measuring noise is filtered out from the sensor signal.
 5. A computer-implemented method for monitoring at least two redundant sensors arranged in a chemical plant, comprising: a) providing at least two redundant sensors, b) providing a first sensor signal of a first sensor of the at least two redundant sensors, the first sensor signal comprising at least one measured value, c) providing at least one further sensor signal from a further sensor of the at least two redundant sensors, the further sensor signal comprising at least one further measured value, d) generating at least one first analysis signal from the first sensor signal, e) generating at least one further analysis signal from the further sensor signal, f) selecting a time horizon for the sensor signals from b), c) by comparison of the analysis signals from d) and e) with predefined limits for the variance, stationarity and/or dynamics of the sensor signal, g) determining at least one correlation between the first analysis signal of the first sensor and the analysis signal of the further sensor, h) comparing the correlation with at least one admissible correlation range or the difference with an admissible difference range, and i) depending on the result of the comparison according to h), determining whether at least one sensor of the two redundant sensors is faulty, j) issuing the determination according to i); wherein in d), a second derivative of the first sensor signal is generated, and in e), a second derivative of the further sensor signal is generated, and in f), a horizon in which there are a minimum number of datapoints is ascertained, comprising a second time derivative, the absolute value of which lies above a specified dynamics limit value of the second derivative, and wherein in d), a standard deviation of the first sensor signal is generated as a further analysis signal of the first sensor signal, and in e), a standard deviation of the further sensor signal is generated as a further analysis signal of the further sensor signal, and in g), the determination of a correlation comprises maximizing the cross-correlation between the standard deviation of the first sensor signal and the standard deviation of the further sensor signal.
 6. The method according to claim 5, wherein the cross-correlation is maximized by maximizing the covariance between the standard deviation of the first sensor signal and the standard deviation of the further sensor signal by way of different time displacements (ΔT).
 7. The method according to claim 6, wherein a fouling time is determined as the correlation from the time displacement performed, the fouling time is compared with an admissible fouling time range, and depending on the result of the comparison, it is determined whether there is a faulty sensor.
 8. The method according to claim 1, wherein a spatial distance between the first sensor and the further sensor is determined, and depending on a volumetric flow measurement and on the spatial distance between the sensors, at least one of the sensor signals provided is processed on a time basis.
 9. The method according to claim 8, wherein depending on the spatial distance between the first sensor and the further sensor, one of the sensor signals provided is processed on a time basis by a delay element of at least the first order, and/or depending on the volumetric flow measurement and on the spatial distance between the sensor and the further sensor, one of the sensor signals provided is processed on a time basis by a dead time element.
 10. The method according to claim 1, wherein, before determination of the first analysis signal and/or of the further analysis signal, at least one of the recorded sensor signals is filtered in a filtering step in such a way that at least measuring noise is filtered out from the sensor signal.
 11. A monitoring device for performing the method of monitoring at least two redundant sensors arranged in a chemical plant or an aircraft according to claim 1, comprising: at least one receiving device designed for receiving a first sensor signal of a first sensor of the two redundant sensors and for receiving at least one further sensor signal from a further sensor of the two redundant sensors, the first sensor signal comprising at least one measured value and the further sensor signal comprising at least one measured value, at least one processing device designed for generating a first analysis signal from the first sensor signal and for generating at least one further analysis signal from the further sensor signal, the processing device being designed for determining at least one correlation condition between the first sensor signal and the further sensor signal at least in dependence on the first analysis signal and the further analysis signal, wherein the at least one correlation condition comprises selecting a time horizon for the sensor signals by comparison of the analysis signals with predefined limits for the variance, stationarity, and/or dynamics of the sensor signal, and determining at least one correlation between the first analysis signal of the first sensor and the analysis signal of the further sensor, at least one comparing device designed for comparing the correlation condition with at least one admissible correlation range, and at least one evaluation device designed for determining whether, depending on the result of the comparison, at least one sensor is faulty.
 12. Chemical plant, comprising: at least one monitoring device according to claim
 11. 13. Aircraft, comprising: at least one monitoring device according to claim
 11. 